HybridAttack-Cloud&Identity

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Attribute Value
Type Workbook
Solution Hybrid Attack - Cloud & Identity
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AADNonInteractiveUserSignInLogs
AADServicePrincipalSignInLogs OperationName in "Add app role assignment to service principal,Add delegated permission grant,Add service principal credentials,Admin deleted security info,Admin registered security info,Admin updated security info,Consent to application,GetBlob,ListBlobs,ListBlobsHierarchySegment,ListContainersSegment,Set domain authentication,Set federation settings on domain,User changed default security info,User deleted security info,User registered security info,User updated security info"
OperationName has_any "clusterrolebindings,rolebindings"
OperationName has_any "cronjobs,daemonsets"
OperationName has_any "cronjobs/create,daemonsets/create"
AADUserRiskEvents
AuditLogs
AzureActivity ActivityStatusValue == "Success"
Caller contains "@"
OperationNameValue == "Microsoft.Authorization/roleAssignments/delete"
OperationNameValue contains "WebApplicationFirewall"
OperationNameValue contains "azureFirewall"
OperationNameValue contains "firewallPolicies"
OperationNameValue contains "networkSecurityGroup"
OperationNameValue contains "roleAssignments"
OperationNameValue contains "routeTable"
OperationNameValue contains "routes/"
OperationNameValue contains "subnets"
OperationNameValue contains "virtualNetworkGateway"
AzureDiagnostics 🔶 Category == "kube-audit"
Category has "kube-audit"
BehaviorAnalytics ?
CloudAppEvents ActionType in "MailItemsAccessed,New-InboxRule,Set-InboxRule,Set-Mailbox"
CloudAuditEvents ? ?
CloudProcessEvents ? ?
CloudStorageAggregatedEvents ? ?
CommonSecurityLog DeviceEventClassID == "0100044547"
DeviceProduct != "Cortex XDR"
DeviceProduct !has "ASM"
DeviceVendor == "Fortinet"
DeviceInfo ?
DeviceNetworkInfo ?
Event
IdentityInfo ?
SigninLogs
StorageBlobLogs StatusCode in "200,206"
ThreatIntelIndicators ObservableKey == "ipv4-addr:value"

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Workbooks · Back to Hybrid Attack - Cloud & Identity